Katello (Product): news timeline & CVEs

CVE-2026-56097: Katello: SQL injection in Registry Proxy labels (fixed in 4.21.2, 5.0.1)

Katello Registry Proxy label parameters allow authenticated SQL injection that can cross authorization boundaries.

Katello, the content-management plugin for Foreman, patched CVE-2026-56097, a SQL injection in Registry Proxy label handling. An authenticated low-privilege user can pass unsanitized label parameters that are interpolated into database queries and expose data across authorization boundaries. Affected releases are Katello 4.13.0 through 4.21.1.1; the fix is in 4.21.2 and 5.0.1. The disclosure does not report active exploitation.

oss-securityOct 7, 04:36 UTC · 10d agoVulnerability 2 sources CVE-2026-560971

CVE-2026-56098: Katello: Registry Proxy authorization bypass (fixed in 4.21.2, 5.0.1)

Katello Registry Proxy lets low-privilege users bypass authorization and enumerate organizations and products.

Katello fixed CVE-2026-56098, an authorization bypass in the Registry Proxy. An authenticated low-privilege user can skip authorization checks and enumerate organizations and products by observing response differences. Affected versions are Katello 4.13.0 through 4.21.1.1 and 5.0.0, with a CVSS 3.1 score of 4.3 (Moderate). Fixes are in Katello 4.21.2 and 5.0.1; exploitation in the wild is not reported.

oss-securityOct 7, 04:34 UTC · 10d agoVulnerability 2 sources CVE-2026-560981

Katello

Timeline2 articles

Related CVEsby mentions

Appears with

CVE-2026-56097: Katello: SQL injection in Registry Proxy labels (fixed in 4.21.2, 5.0.1)

CVE-2026-56098: Katello: Registry Proxy authorization bypass (fixed in 4.21.2, 5.0.1)